Abstract: Examples described herein generally relate to a server for hosting process isolated containers within a virtual machine. The server includes at least one physical processor; at least one physical computer memory storing executable code for execution by the at least one physical processor, and a physical network interface controller, NIC. The executable code may be configured to provide a host virtual machine and at least one process isolated container within the host virtual machine. The physical NIC includes a physical NIC switch configured to distribute incoming data packets to a plurality of functions including a physical function and virtual functions. At least one of the virtual functions is assigned to an individual process isolated container within the virtual machine. The virtual function assigned to the individual process isolated container allows the physical NIC switch to distribute incoming data packets for the individual process isolated container at a hardware level.

Abstract: Examples described herein generally relate to hosting kernel isolated containers within a virtual machine. A server includes a physical processor and a physical computer memory storing executable code, the executable code providing a host virtual machine including a kernel and at least one kernel isolated container within the host virtual machine. The server includes a physical network interface controller, NIC, including a first physical NIC switch and a second physical NIC switch. The first physical NIC switch is configured to distribute incoming data packets to a first plurality of functions including a physical function and virtual functions. At least one of the virtual functions is assigned to the host virtual machine. The second physical NIC switch is configured to distribute the incoming data packets for the host virtual machine to a second plurality of virtual functions including a respective virtual function assigned to an individual kernel isolated container.

Abstract: Embodiments relate to hypervisors that provide hardware isolated virtualization environments (HIVEs) such as containers and virtual machines (VMs). A first HIVE includes a first virtual network interface card (NIC) and a second HIVE includes a second virtual NIC. Both virtual NICs are backed by the same physical NIC. The physical NIC has an Internet Protocol (IP) address. The virtual NICs are assigned the same IP address as the physical NIC. A networking stack of the hypervisor receives inbound packets addressed to the IP address. The networking stack steers the inbound packets to the virtual NICs according to tuples of the inbound packets. Packets emitted by the virtual NICs comprise the IP address, pass through the network stack, and are transmitted by the physical NIC with headers comprising the IP address.

Abstract: Embodiments relate to hypervisors that provide hardware isolated virtualization environments (HIVEs) such as containers and virtual machines (VMs). A first HIVE includes a first virtual network interface card (NIC) and a second HIVE includes a second virtual NIC. Both virtual NICs are backed by the same physical NIC. The physical NIC has an Internet Protocol (IP) address. The virtual NICs are assigned the same IP address as the physical NIC. A networking stack of the hypervisor receives inbound packets addressed to the IP address. The networking stack steers the inbound packets to the virtual NICs according to tuples of the inbound packets. Packets emitted by the virtual NICs comprise the IP address, pass through the network stack, and are transmitted by the physical NIC with headers comprising the IP address.

Abstract: Methods and devices for load balancing of connections may include receiving, at a management component on a container host on a computer device, at least one data packet based on a destination IP address of the data packet that corresponds to a plurality of container hosts. The methods and devices may include selecting a destination container from at least one container host on the computer device and other computer devices in communication with the computer device over a virtual network to balance a data load and translating the source IP address of the at least one data packet to a local IP address of the container host. The methods and devices may include changing the destination IP address of the at least one data packet to a virtual IP address of the selected destination container so that the at least one data packet is transformed to a proxy data packet.

Abstract: Embodiments described herein relate to providing hardware isolated virtualized environments (HIVEs) with network information. The HIVEs are managed by a hypervisor that virtualizes access to one or more physical network interface cards (NICs) of the host. Each HIVE has a virtual NIC backed by the physical NIC. Network traffic of the HIVEs flows through the physical NIC to a physical network. Traits of the physical NIC may be projected to the virtual NICs. For example, a media-type property of the virtual NICs (exposed to guest software in the HIVEs) may be set to mirror the media type of the physical NIC. A private subnet connects the virtual NICs with the physical NICs, possibly through a network address translation (NAT) component and virtual NICs of the host.

Abstract: Methods and devices for load balancing of connections may include receiving, at a management component on a container host on a computer device, at least one data packet based on a destination IP address of the data packet that corresponds to a plurality of container hosts. The methods and devices may include selecting a destination container from at least one container host on the computer device and other computer devices in communication with the computer device over a virtual network to balance a data load and translating the source IP address of the at least one data packet to a local IP address of the container host. The methods and devices may include changing the destination IP address of the at least one data packet to a virtual IP address of the selected destination container so that the at least one data packet is transformed to a proxy data packet.